Posted
by
Zonkon Saturday September 10, 2005 @03:21PM
from the intense-lockdown dept.

Stephen de Vries writes "Mac OS X is one of the most secure default installations of any OS. But it is still possible to lock the OS down further, in order to meet corporate security guidelines or to securely use network services. Corsaire has released a guide to Securing Mac OS X Tiger (long pdf) which addresses the new security features introduced through Tiger and presents some security good practice guidelines."

There have warnings accompanying long related articles for time eternal - some people come here primarily for discussion (sort of like an online book club). The article is a "necessary nuisance" for this bunch, hence the disclaimer. For those who actually come for information it isn't so much of a concern.

Now since I'm here for discussion, what's the deal with.pdf's? It seems to be a running belief that putting one's poorly thought out, poorl

If you're going for corporate security, you're probably going to look at every aspect you need to lock down. Security by default matters for 90% of desktop users, but don't you disable services/add firewalls as soon as you set up your OS?

Having a secure default install means that the admins don't have to do nearly as much work to secure it. This means that you can get away with fewer administrators, and therefore, it has the potential of being cheaper for a company to get an OS that starts out secure.

A company would be foolish not to consider the security of the default install of an OS and comparing it with the security of others.

Which is the biggest roadblock keeping OSX from becoming popular in the corporate environment. Are you going to specify Macs if it means certain downsizing of your department in the near future? Are your fellow IT staff going to let you get away with it?

The thing that I notice about Windows security in corporate environments is that even when it's so restrictive that using your computer becomes almost impossible, there are still ways around it.

I've seen very secure corporate environments using OS X where everything works splendidly (including roaming profiles actually carrying _all_ of your settings with you). Also, the security manages not to get in the way of day-to-day activity.

What you're saying is true (I'm sorry I spent my mod points, you're surely due some). This has been frustrating me about Windows since I was an NT4 admin years back. On the recommendation of a certain famous web designer, I tried out Linux.That really opened up my eyes to the beautifully simple approach Unices take towards multiuser security.

The thing that I notice about Windows security in corporate environments is that even when it's so restrictive that using your computer becomes almost impossible, there are still ways around it.

It comes from the basic approach to security that is different in windows from pretty much any other system. Other systems assume the user has no administrative privileges, and require positive credentials to gain those privileges.

Windows assumes the user is also the administrator, and you must remove privileges from

You can only lock down an OS to a certain degree without impeding productivity of users. If the OS is insecure by default, locking it down could affect the functionality of the software users run on the machine. However, if you have a pretty secure system to start with your software is likely to function as it normally would.

One of the features that this article highlights is the Secure swap space, which allows you to have your swap space encrypted so that it cannot be read either unintentionally or intentionally. FileVault is fairly secure for storing business documentation, etc also. Article is well worth a read for any mac user, and non mac user who may have macs in their environment

When you encrypt files with Windows, a copy of the file's key is encrypted against the key of each user with access to the file. With Windows, there are several additional keys that all keys are encrypted against, reputedly for law enforcement activities. (I can't find anything backing up the law enforcement claim apart from conspiracy nutcake sites, but the fact remains that the unexplained extra keys do exist.)

Anyone know if filevault's key is encrypted against anything apart from the user's key and the optional recovery key?

Is FileVault a free software program? I ask because parts of MacOS X are proprietary and parts are free software; if the program is non-free software, then I'd be curious to know how anyone could answer the question about how it encrypts in such a way that the answer would be informative.

FileVault is just an Automounted encrypted AES-128 disk image.
In order to get the whole sequence mostly invisible to the user, they re-wrote the login code to enable the disk image to be mounted before your KeyChain was available (as the KeyChain is stored on the encrypted image.

Parts of FileVault (the image mounter and stuff) are in Darwin and thus you can see the source, however hdiutil and hdid (control most of disk image subsystems) are not available as Apple considers them competitive advantages.

Security still depends on the user of the software, even the most secure system can be opened WIDE up if someone chooses (or chooses without knowing) to make it so. You can have everything encrypted, but if your password is easily guessable then your encryption is weak. This goes with the thought that "A system is only as secure as it's weakest point."

I didn't see any mention of disabling this dangerous feature in the article.

By default, OS X stores your password as a nice secure hash. However, it also stores it using Windows' shitty hash method, that takes approximatly 0.000000001 seconds to brute force with John the Ripper [google.com].

Where is it storing the password as a Windows hash? As of 10.3 all new account passwords are stored using a ShadowHash (and not crypt) and if you change your password in the accounts prefpane and it was previously stored via crypt, it'll be upgraded to ShadowHash.

Cortana: "By default, OS X stores your password as a nice secure hash. However, it also stores it using Windows' shitty hash method, that takes approximatly 0.000000001 seconds to brute force with John the Ripper"

On Tiger, this is not true. In Tiger, one has to explicitly check a checkbox for each user, and enter that user's password, to allow those users to use Windows sharing. The sheet with these checkboxes states:

"Sharing with Windows computers requires storing your password in a less secure manner. You must enter the password for each account that you want to enable."

So, Windows file sharing is there, but Apple has not exactly made it easy to enable it.

Given this UI, I guess that there is no way to secure this weakness in Windows file sharing without breaking compatibility.

You can specify any keychain file as your default, and it can be anywhere. If that's a CF card in the PCMCIA slot, your keychain is removable. Thumb drives also work, of course, but the CF card doesn't protrude beyond the case.

As a Security Architect for a major bank in my country and an "I don't do windows" user at home (OS X, linux), I found this document to be a brilliant guide to securing an OS X client.

I had already applied some of the security recommendations, such as enabling security on Open Firmware, but I've just learned there are a plethora of other security options available on Mac OS X 'out of the box'.

There are options in Tigers security preferences that allow swap space to be encrypted and to avoid passwords being accessible in the clear when stored in memory and swapped to disk. Kernel core dumps can be be disabled for similar reasons.

Password policies! I had no idea Tiger could do that.

After going through this article and learning a bit more about how KeyChain works, I've started creating my own keychains to store 'Secure Notes' and I've finally accepted that Safari does do 'auto-logon' securely in the way it uses KeyChain.

It can starting with 10.3. I have an older article about it on my site here [afp548.com]. The article is from 10.3, but really just more of it works now on 10.4. Also look at the site for my login times script that uses pwpolicy to imitate the login hours policy that other OSes offer admins.

Last year at MacWorld SF, I put together a pwpolicy GUI in AppleScript Studio for a live demo. I also did a minor bit of pwpolicy scripting at WWDC this year. If you have an

Seriously... after watching some dipshit try over 4,000 times within the span of a couple hours to attempt buffer overflows on every listening port on my honeypot last Friday afternoon, before I finally blacklisted his entire class C from my router, I've come to the same conclusion that the DoD has... that NO computer connected to the Internet can be made secure... period... that you should only connect disposeable devices to the public Internet.

I even wonder if I'm not the bigger dipshit for sitting there watching this idiot half the afternoon, throwing the kitchen sink at my poor machine in vain, before pulling the plug on him and banishing his whole netblock.

An OS without *any* open ports can still be vulnerable, by merely having a TCP/IP stack connected to a public network. Even if the stack merely can only respond to ICMP packets (no tcp or udp ports open, nor any other IP protocols enabled), it can still theoretically be vulnerable to DoS attacks via ICMP.

Stop spreading FUD to the uninitiated. You are either trolling or you know just enough to be dangerous. A DoS is a Denial of Service which may temporarily block access to a network or worst case crash the stack possibly forcing a reboot. Big deal. I believe I was responding to exploits which could be used to "run" code.

Nobody is going to DoS a workstation anyway. Come on let's be realistic here.

I have long since disabled password logins in favour of public key, due to all the scripting probing going on these days...or at least I thought I had. I had set PasswordAuthentication in/etc/sshd_config to no, but was alarmed to discover a coworker logging in with his password the other day.

Knowing that this was a new development in Tiger, I compared the new config file with an older one from Panther and noticed the line #UsePAM no. Uncommenting this finally disabled passwords, which implies that the

This is very interesting. The article points out that small businesses and individuals get cracked more than big organizations. It also points out that more people use Windows and Linux than Mac OS X and BSD. I wonder if the numbers take that into account. Are the Linux statistics balanced with the windows counts, etc?I think there might be two problems with the information assuming the numbers are normalized on installs vs succesful compromises. First, Mac OS X is the most widely sold UNIX like OS in

That report is almost a year old, and is based on data "spanning a period from November, 2003 to October 2004".

Sorry, when it comes to security, I like fresh data...

That report might have been accurate at that very moment in time, but the area of information security is so dynamic, that older reports, such as this one, while insightful, shouldn't be used as a barometer for the present or the future.

Wow, bundling iTunes (a program which lets you load MP3s onto an iPod) with an iPod. What blatant disregard for the consumer, who is powerless to install other iPod interface software [ephpod.com] or buy a different MP3 player.

An especially never enter console commands on/. rated anything other than informative, even that is a bad idea. Never enter a console command without first reading the man page, yes it's long and could be a bore, but its not as boring as restoring from backups (if you have backsups of some important directory that you forgot about).

Windows has the same feature, so what?On Linux you can install libtrash or any other kind of protection, which is much nicer than any filesystem default, so what?On VAX all the versions were collected, so what??

It is downtime and service needed that counts not someone with EnCase. Problem is that you can do rm / by default and not what it does and not wheter Mac is holy or not.

Yes, the downtime is a problem. The point I was trying to make is that doing a sudo rm -rf/ or its equivalent on any system isn't secure, your files aren't really gone. A lot of people (maybe not people here, but in general) don't realize that. Buy a used hard drive on eBay sometime and see what you can find.

But, what if normal user can do it due to the lack of security? Like on OSX.

Although your comment was correct in every aspect, it also failed in every other viewpoint.

It is not the question of security if files are gone or not (if this would be the question then your comment is 100% correct), real question here is "Can they dissapear (even temporarily) due to lack of security and couse loss or downtime?"

I'm not disagreeing with your point; I think we're reading the original post differently. The way I read it, sudo rm -rf/ was given as a (joke) method of securing the files on your computer from anyone breaking into them.

Like any other Unix system, you should take care who gets sudo access. In the case of OS X, and Admin user can use sudo, while a Standard account can not.

Yep, exactly as I said. You are just as 100% correct, as you are 100% wrong. Result depends on starting viewpoint.Question here is if default user (usualy users don't create more separate accounts) is admin:) and if "sudo rm" is possible by default.

Maybe you didn't get it, but joker (as you described parent poster) was aiming at the same sentence (and the same flaw, default user being admin by default, I'm not saying you can't restrict this account) as I did:)Transcribed from original/. articleStephen de V

Unplug the power. I mean, we all know the most secure computer is the one that's turned off, right? And of course it should be locked up in a safe in a deep dark cavern protected by a dragon or something.

the same "piece of crap" that apple is switching to?
face it: microsoft may suck, but intel (and amd) has given a pretty nice performance/price ratio compared to apple hardware. Maybe it's cause the power pc wasn't manufactured in massive quantities? I don't know.